CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and...
CVE-2019-3462 is a high vulnerability (CVSS 8.1) in Canonical Ubuntu Linux, published January 22, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.6%, the 96th percentile. Fixed in apt 1.8.0~alpha3.1.
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
CVE-2019-3462- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
CVE-2019-3462- Updated
- 2026-11-02
EUVDEUVD-2019-13101 No score
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
EUVD-2019-13101- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q857-rhg5-4j49
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and...
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
GHSA-q857-rhg5-4j49- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
CVE-2019-3462- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
DEBIAN-CVE-2019-3462- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-3462
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Record
UBUNTU-CVE-2019-3462- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3863-1 No score
apt vulnerability
Max Justicz discovered that APT incorrectly handled certain parameters during redirects. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages.
- Record
USN-3863-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 1.8.0~alpha3.1 | 1.8.0~alpha3.1 |
aptDebian:13 |
before 1.8.0~alpha3.1 | 1.8.0~alpha3.1 |
aptDebian:14 |
before 1.8.0~alpha3.1 | 1.8.0~alpha3.1 |
aptDebian:8 |
before 1.0.9.8.5, plus listed versions 1.0.9.81.0.9.8.11.0.9.8.21.0.9.8.31.0.9.8.4 |
1.0.9.8.5 |
aptDebian:9 |
before 1.4.9, plus listed versions 1.4.61.4.71.4.8 |
1.4.9 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.19, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 27 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.11.0.1ubuntu2.31.0.1ubuntu2.4.11.0.1ubuntu2.51.0.1ubuntu2.61.0.1ubuntu2.71.0.1ubuntu2.81.0.1ubuntu2.91.0.1ubuntu2.101.0.1ubuntu2.111.0.1ubuntu2.121.0.1ubuntu2.131.0.1ubuntu2.141.0.1ubuntu2.151.0.1ubuntu2.171.0.1ubuntu2.18 |
1.0.1ubuntu2.19 |
aptUbuntu:16.04:LTS |
before 1.2.29ubuntu0.1, plus listed versions 1.0.10.2ubuntu11.1.41.1.51.1.101.2.3 Show 18 moreShow less1.2.41.2.61.2.71.2.81.2.91.2.101.2.10ubuntu11.2.12~ubuntu16.04.11.2.151.2.15ubuntu0.21.2.181.2.191.2.201.2.241.2.251.2.261.2.271.2.29 |
1.2.29ubuntu0.1 |
aptUbuntu:18.04:LTS |
before 1.6.6ubuntu0.1, plus listed versions 1.51.5.11.6~alpha51.6~alpha7ubuntu11.6~alpha7ubuntu2 Show 8 moreShow less1.6~beta11.6~rc11.61.6.11.6.21.6.31.6.3ubuntu0.11.6.6 |
1.6.6ubuntu0.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | atilacastro/update-apt-package | 2019-02-13 |
| PoC in GitHub | tonejito/check_CVE-2019-3462 | 2019-01-24 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
securityfocus.com/bid/106690
usn.ubuntu.com/3863-1
lists.debian.org/debian-lts-announce/2019/01/msg00013.html
debian.org/security/2019/dsa-4371
Show 10 moreShow less
security.netapp.com/advisory/ntap-20190125-0002
lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-3462
github.com/advisories/GHSA-q857-rhg5-4j49
security-tracker.debian.org/tracker/CVE-2019-3462
ubuntu.com/security/CVE-2019-3462
cve.org/CVERecord?id=CVE-2019-3462